ENCYCLOPEDIA OF Espionage, Intelligence, and Security Volume ...

Cyber Securitythe computer age, many people print information andthen discard it. A diligent search of a person’s trash cansometimes obtain a great deal of sensitive information.Intelligence personnel masquerading as janitors orother staff can gain access to computers in off-hours, and,utilizing deciphered user names and passwords, can delveinto databases for information.Cyber security also focuses on equipment. Computersthat are linked via electrical wire (i.e., Ethernet networks)typically have many wall jacks (”network drops“),by which computers are connected to the network. Avacant network drop that has not been disabled can besurreptitiously used to connect with the network. Softwareis available that enables the connected computer tocapture all data that is flowing through the network.Wireless networks carry other security risks, as arogue computer does not need to be physically connectedto a network drop in order to acquire information. Furthermore,if the signal from a wireless network extends beyondthe boundaries of a building, intelligence can begathered even from someone parked outside.Usernames and passwords are another vulnerableaspect of a computer network. The tendency of people totrust someone making a request for user information, andto use the same easy-to-decipher identifiers repeatedlycan allow an intruder to gain access to a network.Email is especially prone to breaches in security. Theinformation in most emails, including the username, is inplain text. Applications are available (i.e., MailSnarf) thatallow email transiting from sender to receiver to be retrievedand read by a third party. Thus, an attacker canread sensitive information contained in an email and aswell, can hijack an email account to send and receivemessages. Emails often have documents attached to them.This route is used to deliver malicious codes (i.e., viruses,worms, Trojan Horses) to computers.Viruses are small programs that become embeddedin files. Once a file is infected, the virus can execute itsfunction. Depending on the intent of the virus designer,the result can be merely inconvenient to extremely destructive.Thousands of viruses exist, with new ones appearingdaily. Thus, viral cyber security requires constantupdating of viral protection software.Trojan Horses are applications that are disguised asuseful programs. Once activated, Trojan Horses permit aremote user to have access to the host computer, via theactivated program. This aspect is especially relevant inespionage and the subterfuge can be difficult to detect.Attackers sometimes utilize authorized network connections,in effect assuming the identity of the authorizeduser. Another attack strategy is called man-in-the-middle.Here, a third party—the attacker or intelligence-gatherer—impersonates both ends of a connection. The real senderand receiver are unaware that their communications arenot proceeding directly to the destination. A third strategyis called the replay attack. In the replay attack, transmissionsare intercepted, read, and passed along to the rightfulfinal destination.Cyber security MeasuresThe perimeter security model is the most popular type ofcyber security model. The defenses are set to preventintrusion while allowing authorized user activities to proceedunimpeded.Typical perimeter defenses include firewalls (whichfilter incoming information according to set criteria foracceptance, such as IP address, domain name, protocol ofsender-receiver communication, key words or phrases),intrusion detection systems, and virtual private networkservers (where data is encrypted at the sending end anddecrypted at the receiving end). When all the componentsare operating properly, a perimeter defense allows onlythose authorized activities to proceed from the ‘outside’(i.e., the Internet) to the individual computer or computernetwork. However, improperly configured perimeter devicescan create an illusion of security while offering littlesecurity at all.Administrative scrutiny. Data are often backed up ontotapes. Being portable, the tapes are liable to theft. If thetape data are not encrypted, the information can be transferredor copied to another computer.Another aspect of cyber security is the identificationand approval of all hardware. The unapproved installationof a piece of hardware such as a modem or a firewall cancompromise an entire network, if the installed item is notproperly configured. For example, an improperly configuredfirewall can allow access to the Internet when onlyreceipt and transmission of email should be permitted. Adedicated systems administrator is the best guarantee ofdaily scrutiny of a network’s performance and vulnerability.A key component of a cyber security plan is thepresence of a fallback plan in case of misadventure ordeliberate sabotage.Evaluation of the performance of some security measuresis a prudent precaution. This can only be accomplishedby triggering the measures by a staged attack. Forexample, former computer hackers are now employedby companies and government agencies to probe thevulnerabilities of a computer system. This surreptitioustesting, even of the security personnel, is known as redteaming.Breaching of cyber security. Computer and network securitytends to be expensive and can require additional operationson the part of the user. The installation of safeguardsdoes not increase the operational efficiency of a computer300 Encyclopedia of Espionage, Intelligence, and Security